86358aca554e8d3fcc3d3708e76aafdd908c5ae54f1811bf1971b74b404dc2bf

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaGXSetup.exe
Size 4.0MB
Sample261027-v1eynsv1bx
SHA256 86358aca554e8d3fcc3d3708e76aafdd908c5ae54f1811bf1971b74b404dc2bf
MD5 4d32005f1963096853c55e5aec49d648
SHA1 90f989bdc8da3a3dd4e76d755063b1ae77aa8d58
SHA512 4ee430ca02d74ed4a2d1563245712889f096253723e34f712896658327555309a3b20c101994664d4909cb966c375bc108b84945bf1c91679f3d7191b0aaab98
SSDEEP 98304:zA1K0gwkdLllHPT+rxB9c2mDkfTOKtZXYjPKXEaaHxG2PUmf9M4WQ:jdrYxB9OkfT7jXY2XEaaHx595
TLSH
T1C41633257B858076D5A325324FA8FB6D9A3DBA741F62069B37C81E6FDF30181A530F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	2488	installer.exe

Executes dropped EXE 6 IoCs

pid	Process
2488	installer.exe
3100	installer.exe
1572	installer.exe
3824	Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe
4292	assistant_installer.exe
1904	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
4292	assistant_installer.exe
4292	assistant_installer.exe
1904	assistant_installer.exe
1904	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\dbghelp.dll	Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2488	installer.exe
2488	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 2488	5408	OperaGXSetup.exe	89
PID 2488 wrote to memory of 3100	2488	installer.exe	90
PID 2488 wrote to memory of 1572	2488	installer.exe	91
PID 2488 wrote to memory of 3824	2488	installer.exe	92
PID 2488 wrote to memory of 4292	2488	installer.exe	93
PID 4292 wrote to memory of 1904	4292	assistant_installer.exe	94

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Users\Admin\AppData\Local\Temp\7zS0250E119\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0250E119\installer.exe --server-tracking-blob=ZDBhZWExMzc5ZDM5NTgzYjA5NzM4ODZmNTc2MzNkMmQ4NGM1OGI5NTA1MzBmMjcwZGQ2ODI4NTc5MmFmYjRlNTp7ImNvdW50cnkiOiJIVSIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1Mb290bGFicyZ1dG1fbWVkaXVtPXBhJnV0bV9jYW1wYWlnbj1Mb290bGFic19IVSZ1dG1fY29udGVudD0xMzUxNzM2JnV0bV9pZD00MzYxNTQ2MTg4NTQ5MDgyJmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mZGxfdG9rZW49Mzc1MTYyODUiLCJ0aW1lc3RhbXAiOiIxNzkzMTIyMDEwLjI5MTMiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTU2LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJMb290bGFic19IVSIsImNvbnRlbnQiOiIxMzUxNzM2IiwiaWQiOiI0MzYxNTQ2MTg4NTQ5MDgyIiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiTG9vdGxhYnMifSwidXVpZCI6ImNmY2NlZWJjLWRjZWItNGI1Yi1hMGNjLTg2NmMwNGVhMGM4NSJ9
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\7zS0250E119\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0250E119\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ff7670602d8,0x7ff7670602e8,0x7ff7670602f8
    3⤵
    - Executes dropped EXE
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - Writes a Windows system DLL name to a user directory
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x47b558,0x47b564,0x47b570
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\additional_file0.tmp
Size 3.2MB
SHA256 ff87215ff4c75e1f741fae5b0d7d00b933c2e967e70ce31431d898a4de998131
MD5 9aee4a436778bba572e429bfb8f10263
SHA1 6a1ab229ae3ecb064596f1b694c02ff18fcff352
SHA512 a9e516b5a9d90e0e8a328a0078bdbf782734b05af65ebd7f43e493ca2d962e44c042d413e4d15ef352cb2163725190b671909d32fc436a941a89abc0b090628f
SSDEEP 98304:Tkio8qAxndcSJFb/9fYTFDAJqOrmDGUy6LlHdyAI9n7xFYaIXb:TlqAxn/F79wTFDoqG8XyW9o1xiL
TLSH
T12FF53352AA94C4B0D52315374CE9B3FE5AFFF6617EA41B9F23880B4E9FB05D2981041B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\assistant_installer.exe
Size 2.5MB
SHA256 677a5ca267c49bcd4e39cba49ad0a7e2f489523a070f1b113512497f5d489d76
MD5 704647b8c3db95f4f8ef554eb2849a2e
SHA1 3669a684c5733fee82b8235d7347c987885c4a99
SHA512 4215c8afc883d7cab206094493c551c06b2128b0ec7ff5ac388e05d8168cc3257fd2cf73c7a87b5b0b5fad180f3674789c88682a48e3f87f150bde6251be954b
SSDEEP 49152:/5zJ7lRnxcSTHGKbmaO8b2j3R2I0Ya9NF7ayPsoWcqCxlv8RUjQa8jN40:/XxxDGlafQ3R10p93fPxWc3xlvcUpCNp
TLSH
T140C59E01786090B4D8563072711CBB3E9E605E169735DDCBEBE8BCC46BB46E2263B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\browser_assistant.exe
Size 5.3MB
SHA256 8dbcc04ba61e81430dd5ced37d93e9a0a4d9c07cdbf69d1acd1a52cb3994e325
MD5 2ca9049b8046875e0c2d9b5d2d58d12e
SHA1 f0d13b562b7d49763d644a9233287bafb711bedd
SHA512 697eb65aab4ae2c556fae06932d6a8d553ffce692f50c7a8aad7345c6eb0f78313849c2b172ed9ef38794e4a1d05457cc8ac52e3ded96f6f306bba53609e7996
SSDEEP 98304:i6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwI:XuwTTmYkJumW2tbE6smmPFGoT3sz+l
TLSH
T1E346AE42E71120B8CC066571643C6B7B8C285D63AB2187DF9BD87CA12BB45C2367FB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\dbgcore.DLL
Size 238KB
SHA256 318609aa3f5a6022465532846da2d8e0beda1e12c6b1be3886fecd395cf2081c
MD5 cb0747323f4dd2a96fc707d32aa566ed
SHA1 6109ee034ede6c05051cca5fa8c3d6ae4a7babec
SHA512 d96f4fd14547fbbd8e022c49854e26160daa71a43ef60318f89ff4a9f9692f3e467877a05455e03bf5bb35ccc658b65755b31a0569f27640fb852d646d793f33
SSDEEP 6144:ggIASx0NdOiN9a1WpPNmiFZr09fgPczwishfCpkIJnwsnpb/xetMf:gWDFDi7yIJnwA3aMf
TLSH
T14E347D61A6C48475CECB11B4724C7A3682FDD2B223E080D392549BECE9656D5AF3C2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\dbghelp.dll
Size 589KB
SHA256 762839a3070556ef17c36f291b733494ab5adc56a0c7587192c4896b320cc3d8
MD5 3e7647bf24156d135f863fb25e4274e5
SHA1 01df9f8f3f165a98980dc11cc8d74f35288414ca
SHA512 d508c140c426488260e285fd66a85fd29b0bf30fd4e6315e721e0da5dddb62d77d0c18acf633be4a167d7475d87b495cd63b5d49957f1ffaa996d61feeef751a
SSDEEP 12288:jUfvs6QXZkBkp5qbhmJLKAilH77ht8YO6EI6:wfvfQXZkBkp5q1mJLKOYOz
TLSH
T135D47D71A9C04074D5EB22B0296DE73987BDF6614B3091CB63444AEDBA607F06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\files_list
Size 86B
SHA256 403b9075eb28634cb9000e1029fbfb968274642e3a2356d9fbc18c2ab3c60eaa
MD5 33151ad85f370b17515cfb991ba64582
SHA1 c40eabbfd28e0f93f69270958057bdf4c39f2935
SHA512 15bb590da74a00905c9acc98a4d4d93244a44868d6a148ee08e416cd9a0fd939322ffbaaebc06393aa225a59dd72ef73292b6aa055990e5143e74472222d20ea
TLSH
T15AA01204C00E048C6A802056420085FF26C324041664C280025E04C80412017074A731
MD5 SHA1 SHA512 TLSH

Submit Download

msdia140.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\46945440-046e-47d3-b63b-7d3d60be5f2b Opera GX Installer Temp\opera_package_202610271727151\assistant\msdia140.dll
Size 2.5MB
SHA256 237adeb24922202177ef0c8d40750fe72b6490596263d4c9bcb4459a47cce4bd
MD5 9c63dc3e5773b9f38ab7aaef07142154
SHA1 c131f526711ded6c27f06e36385419fae180e87b
SHA512 0d78989e81862c79438c022cb09807120577681161a8040d0a2df7404a48f06e5f78b76cf5a276e690ad69ffc218f45a8a7a157089a227c2246b73c0659eb2f3
SSDEEP 49152:cbrg2fTIsOXnuf7VSxLrah+N0Pl8xW/e2d5FOGB+p:X2EsOef700h+ilX/
TLSH
T188C56C70E60E8634DA8E2031DC7E6B5F52ADAAAB0B7104C773689E7D5C22CC27735587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0250E119\installer.exe
Size 9.2MB
SHA256 fa1023f728eaaf0fa53b6b75813295bc376bc6a96c3ecf7829861bf4bc1dea59
MD5 9ea3b0ac1d0eb4cc9ae5d42fe1d2910c
SHA1 509e002093e5c9e1e2b57ae139276bc6463b98a7
SHA512 ffd7cec8387a520b8ad5acc1113c34819ec2f008e5369021fdad53ee667abd5f5f1ce6936f050ff25f1fe7227383b2da1e79ef871c3b0edc33f610d935c4d0dd
SSDEEP 98304:9vx2ngpeGjea4Lh2IRNJKpqDIDtdSiTcEzFBI3++wteEmM:Rx2ngMVaNuK3tT83+BqM
TLSH
T112A69D53F3A611E8D0AFCA748B7A563299357C464B34A3EF0A943A250E75FD45B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 4498bd3f9a9f7ff78f74c8abfcf0b367ee9442c0c7bb36092247c646ce339923
MD5 d3f39a7a6d2afc1a008e27239d6be651
SHA1 9d9407e1e3babfec6ff2022de1dd84a3e7334f45
SHA512 e200ba033d1c1a42eb2e4ae22647e30ccef7cb6ff8a54322e802f49194e56a410ac9220ff5bac1a03e0ac1a9b0e222ee32096b52cb0e8973eb3c729992f4e9b8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads